Proposing a New Initiative to the OWASP GenAI Security Project

A new initiative is approved by a simple majority vote of the Core Project Management Team (CPMT) and Board of Directors (BoD), after a Board scope check, a core-team review of up to 4 weeks and a 72-hour open vote.

What this guide covers

This guide is for community members who want to propose a new initiative under the OWASP GenAI Security Project. It condenses the initiative sections of the Project Governance document into plain steps and adds the project’s eligibility requirements for new proposals.

An initiative is a structured body of work that extends the project’s scope, such as research, methodology development, whitepapers, code, tools or workshops. Initiatives run under the project banner but define their own outputs. The full governance document remains the authoritative source where the two differ.

Requirements for consideration

Every new proposal must meet the criteria below before it goes to review. They exist to keep initiatives community-led, vendor-neutral and sustained over time.

These sit alongside the governance approval requirements: a reviewed final proposal with a committed roadmap and dates, identified contributor resources sufficient for that roadmap, and any budget requests. Every proposal must also include a $0 version, even if funding is requested.

Submission and approval process

initiative submission flow · 6 steps, 1 review loop

Review can run past 4 weeks only when change requests need additional research or development.

1. Draft the proposal. Copy the Proposal Starter Template and write a one- or two-page proposal covering:

• Goals, objectives and the specific outcomes or artifacts you will produce
• A roadmap with committed dates (first release within 6 months, plus a follow-on release)
• The proposer(s) by name
• The execution team: names and organizations, showing 7–10+ people from 3+ organizations, and any recruiting still needed
• Costs, if any, plus a $0 version of the plan

2. Board scope review. The Board of Directors reviews the proposal only to decide whether it is in or out of scope of the project charter. Out-of-scope proposals stop here. The Board does not assess the team, roadmap or content at this step; that is the core team’s job.
3. Core team review. The core team checks alignment with the project, resourcing, recruitment needs and any funding request. Reviewers may ask for changes. The goal is to finish review within 4 weeks.
4. Revise. Address the change requests and update the roadmap and team list as needed.
5. Final submission. Share the revised proposal with the CPMT in the #team-llm-core Slack channel.
6. Vote. CPMT and BoD members vote. The vote stays open for 72 hours so globally distributed members can weigh in, and passes by simple majority with quorum (51% of the group).
7. Approval. The proposer becomes the Initiative Lead and joins the Core Project Management Team.

When a proposal becomes a workstream

A workstream is a working group inside an existing initiative. It develops and maintains one or more assets within the scope of that initiative’s charter. For example, the Top 10 for LLMs could run a workstream per risk, or a workstream could own a specific asset that is renewed on a regular cycle. Workstream assets are expected to be updated annually.

The Board or core team may vote that a proposal fits better as a workstream within an existing initiative rather than as a new one. In that case the work joins that initiative and follows its roadmap, leadership and review practices.

Some larger initiatives use an expert review board to validate their output. If the host initiative has one, the workstream’s publications may also need review by that board, in addition to community peer review. Not every initiative has an expert review board, so check with the host Initiative Lead early.

After approval

Approved initiatives report progress every two weeks and are retired by the Board if they go inactive.

• Report bi-weekly. The Initiative Lead reports progress to the CPMT and at the bi-weekly open project review meetings.
• Work in the open. Collaborate in the initiative’s designated channels; non-sensitive discussion happens on the project contributors’ Slack.
• Own the roadmap. The lead defines goals and deliverables, coordinates contributors, reviewers and working groups, and keeps tasks on schedule.
• Optional expert review board. A lead may form a board of distinguished experts to validate the initiative’s output.
• License outputs correctly. Content defaults to CC BY-SA 4.0; code prefers permissive OSI licenses (MIT, BSD, Apache 2.0).
• Credit contributors. Contributors and reviewers are listed in the published work.
• Leadership changes. A lead can be removed by a 2/3 vote of the CPMT or the BoD. If a lead steps down with no replacement, or the initiative becomes inactive, the Board decides whether to retire it.

Pre-submission checklist

• ☐ Proposal written on the starter template, one or two pages
• ☐ Goals, objectives and specific deliverables stated
• ☐ Roadmap with committed dates
• ☐ First full release (not 0.1 or pre-release) scheduled within 6 months of approval
• ☐ Our roadmap plans at least two releases. updated at least annually.
• ☐ Peer review step planned for every publication
• ☐ 7–10+ named contributors listed with their organizations
• ☐ Contributors span at least 3 different organizations
• ☐ Recruiting needs identified, if any
• ☐ Budget requests listed, with a $0 version of the plan

Sources

• OWASP GenAI Security Project — Project Governance
• Initiative Proposal Starter Template